1CO. 


Information Commissioner’s Office 


Consultation: Age appropriate design code 


Introduction 


The Information Commissioner is seeking feedback on her draft code of practice Age appropriate 
design: a code of practice for online services likely to be accessed by children (the code). 


The code will provide guidance on the design standards that the Commissioner will expect 
providers of online ‘Information Society Services’ (ISS), which process personal data and are likely 
to be accessed by children, to meet. 


The code is now out for public consultation and will remain open until 31 May 2019. The 
Information Commissioner welcomes feedback on the specific questions set out below. 


For this consultation, we will publish all resoonses except for those where the respondent indicates 
that they are an individual acting in a private capacity (e.g. a member of the public or a parent). All 
responses from organisations and individuals responding in a professional capacity (e.g. 
academics, child development experts, sole traders, child minders, education professionals) will be 
published. We will remove email addresses and telephone numbers from these responses but 
apart from this, we will publish them in full. 


For more information about what we do with personal data please see our privacy notice. 


Please note, we are using the platform Snap Surveys to gather this information. Any data collected 
by Snap Surveys for ICO is stored on UK servers. You can read their Privacy Policy here. 


Section 1: Your views on the code 


Q1 


If no, then please provide your reasons for this view. 


Qia 


Is the "Services covered by this code’ section clearly communicated? 
Q2 @ Yes 
O No 


If no, then please provide your reasons for this view. 


Section 2: Your views on the draft standards 


There are 16 draft standards in the code. You can comment on all the drafts 


standards, or focus on a single standard. If you do not want to answer questions on a 
standard please press skip. 


The standards are: 


1) Best interests of the child 

2) Age Appropriate Application 

3) Transparency 

4) Detrimental use of data 

5) Policies and community standards 
6) Default settings 

7) Data minimisation 

8) Data sharing 


10) Parental Controls 

11) Profiling 

12) Nudge techniques 

13) Connected toys and devices 

14) Online tools 

15) Data protection impact assessments 
16) Governance and accountability 


Best interests of the child: The best interests of the child should be a primary 
consideration when you design and develop online services likely to be accessed 
by a child. 


Q3 ~=@ I would like to comment on this standard 


©) Skip 


Q4 


Q4a 


Q5 


Q5a 


Q6 


Q6a 


Q7 


Q7a 


Q8 


Q8a 


© Yes 
O No 


If no, then please give reasons for your answer. 


O Yes 
© No 


If yes, then please give reasons for your answer. 


©) Yes 
© No 


If yes, then please give reasons for your answer. 


©) Yes 
© No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


O Yes 
© No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q9 Q Yes 


© No 


Q9a My belief is that 'best interest' is closely related to well-being. Would it be useful to refer the 
reader to online information such as the Good Childhood Report 
(https://www.childrenssociety.org.uk/what-we-do/research/what-is-child-wellbeing) to help 
with the definition of short and long term outcomes for children in terms of best interest and 
well-being? 


Age-appropriate application: Consider the age range of your audience and 
the needs of children of different ages. Apply the standards in this code to all 
users, unless you have robust age-verification mechanisms to distinguish adults 
from children. 


ata © I would like to comment on this standard 
©) Skip 
Have we communicated our expectations for this standard clearly? 
Q11 @ Yes 
©) No 
If no, then please give reasons for your answer. 
Qila 
Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 
Q12 © Yes 
© No 
If yes, then please give reasons for your answer. 
Q12a 
Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q13 © Yes 


© No 


If yes, then please give reasons for your answer. 
Qi3a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 

Q14 (©) Yes 
© No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q14a 


Q15 (©) Yes 
© No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q15a 


Q16 Q) Yes 
© No 


If yes, then please provide details (including links). 
Q16a 


Transparency: The privacy information you provide to users, and other 
published terms, policies and community standards, must be concise, 
prominent and in clear language suited to the age of the child. Provide 
additional specific ‘bite-sized’ explanations about how you use personal data at 
the point that use is activated. 


Q17  () I would like to respond to this standard 


© skip 

Have we communicated our expectations for this standard clearly? 
Q18 ©) Yes 

©) No 

If no, then please give reasons for your answer. 
Q18a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q19 (©) Yes 

©) No 

If yes, then please give reasons for your answer. 
Q19a 


Q20 


Q20a 


Q21 


Q21a 


Q22 


Q22a 


Q23 


Q23a 


Q24 


Q25 


Q25a 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


No 
If yes, then please provide details (including links). 


Detrimental use of data: Do not use children’s personal data in ways that 
have been shown to be detrimental to their wellbeing, or that go against 
industry codes of practice, other regulatory provisions or Government advice. 


I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 
Yes 


No 
If no, then please give reasons for your answer. 


Q26 


Q26a 


Q27 


Q27a 


Q28 


Q28a 


Q29 


Q29a 


Q30 


Q30a 


Q31 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


No 
If yes, then please provide details (including links). 


Policies and community standards: Uphold your own published terms, 
policies and community standards (including but not limited to privacy policies, 
age restriction, behaviour rules and content policies). 


I would like to respond to this standard 


© Skip 


Q32 


Q32a 


Q33 


Q33a 


Q34 


Q34a 


Q35 


Q35a 


Q36 


Q36a 


Q37 


Q37a 


Have we communicated our expectations for this standard clearly? 
Yes 


No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this 
standard? 
`) Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Yes 


No 
If yes, then please provide details (including links). 


Q38 


Q39 


Q39a 


Q40 


Q40a 


Q41 


Q4ia 


Q42 


Q42a 


Q43 


Q43a 


Default settings: Settings must be ‘high privacy’ by default (unless you can 
demonstrate a compelling reason for a different default setting, taking account 
of the best interests of the child). 


I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 
) Yes 


No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 


J No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this standard? 
+) Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q44 Yes 


No 
If yes, then please provide details (including links). 
Q44a 


Data minimisation: Collect and retain only the minimum amount of personal 
data you need to provide the elements of your service in which a child is 
actively and knowingly engaged. Give children separate choices over which 
elements they wish to activate. 


Q45 I would like to respond to this standard 


Have we communicated our expectations for this standard clearly? 
Q46 Yes 
`) No 
If no, then please give reasons for your answer. 
Q46a 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Q47 ©) Yes 
No 
If yes, then please give reasons for your answer. 
Q47a 
Do you think this standard gives rise to any unwarranted or unintended 
consequences? 
Q48 Yes 
No 
If yes, then please give reasons for your answer. 
Q48a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q49 Yes 
`) No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q49a 


Q50 


Q50a 


O51 


Q5la 


Q52 


Q53 


Q53a 


Q54 


Q54a 


Q55 


Q55a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


No 
If yes, then please provide details (including links). 


Data sharing: Do not disclose children’s data unless you can demonstrate a 
compelling reason to do so, taking account of the best interests of the child. 


I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 


Yes 


J No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 


No 
If yes, then please give reasons for your answer. 


Q56 


Q56a 


Q57 


Q57a 


Q58 


Q58a 


Q59 


Q60 


Q60a 


Q61 


Q6ia 


Do you envisage any feasibility challenges to online services delivering this standard? 
©) Yes 

©) No 

If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


©) Yes 

C) No 

If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


©) Yes 
© No 
If yes, then please provide details (including links). 


Gi tion: Switch geolocation options off by default (unless you can 
demonstrate a compelling reason for geolocation, taking account of the best 
interests of the child), and provide an obvious sign for children when location 
tracking is active. Options which make a child's location visible to others must 
default back to off at the end of each session. 


© I would like to respond to this standard 
© Skip 


on Yes 
) No 
If | no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


©) Yes 
©) No 
If yes, then please give reasons for your answer. 


Q62  @ Yes 
©) No 


Q62a I agree wholeheartedly with this standard. However, from my clinical experience I 
envisage this will be the standard which parents may be less positive about, given 
that a high number of parents use tracking apps to monitor their child's whereabouts 
(especially in the 10-12 transition stage as children move to secondary school) and to 
feel confident that they are keeping their child safe. So, this standard may require a 
greater degree of information and explanation for parents/carers in order to optimise 
buy-in (and so that parents don't choose a sub-standard tracking app which has less 
obvious switch offs). 


Q63 ©) Yes 
© No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q63a 


Q64 ©) Yes 
© No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q64a 


Q65 ©) Yes 

© No 

If yes, then please provide details (including links). 
Q65a 


Parental controls: If you provide parental controls give the child age 
appropriate information about this. If your online service allows a parent or 
carer to monitor their child's online activity or track their location, provide an 
obvious sign to the child when they are being monitored. 


Q66 I would like to respond to this standard 


Have we communicated our expectations for this standard clearly? 
Q67 Yes 
No 
If no, then please give reasons for your answer. 
Q67a 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q68 Yes 
No 
If yes, then please give reasons for your answer. 
Q68a 


Do you think this standard gives rise to any unwarranted or unintended 


consequences? 
Q69 () Yes 
No 
If yes, then please give reasons for your answer. 
Q69a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q70 Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q70a 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 
Q71 Yes 
No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q71a 


Q72 


Q72a 


Q73 


Q74 


Q74a 


Q75 


Q75a 


Q76 


Q76a 


Q77 


Q77a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


No 
If yes, then please provide details (including links). 


Profiling: Switch options which use profiling off by default (unless you can 
demonstrate a compelling reason for profiling, taking account of the best 
interests of the child). Only allow profiling if you have appropriate measures in 
place to protect the child from any harmful effects (in particular, being fed 
content that is detrimental to their health or wellbeing). 


I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 
Yes 


No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q78 


Q78a 


Q79 


Q79a 


Q80 


Q81 


Q8ia 


Q82 


Q82a 


Q83 


Q83a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Yes 


No 
If yes, then please provide details (including links). 


Nudge techniques: Do not use nudge techniques to lead or encourage children 
to provide unnecessary personal data, weaken or turn off privacy protections, 
or extend use. 


I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 
Yes 
No 

If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 
No 
If yes, then please give reasons for your answer. 


Q84 


Q84a 


Q85 


Q85a 


Q86 


Q86a 


Q87 


Q88 


Q88a 


Q89 


Q89a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 


Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 


Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Yes 


No 
If yes, then please provide details (including links). 


Connected toys and devices: If you provide a connected toy or device ensure 
you include effective tools to enable compliance with this code 


I would like to respond to this standard 


© skip 


Have we communicated our expectations for this standard clearly? 
Yes 


No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 


consequences? 
Q90 Yes 
No 
If yes, then please give reasons for your answer. 
Q90a 


Do you envisage any feasibility challenges to online services delivering this 
standard? 
Q91 Yes 
No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q9ia 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q92 Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q92a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q93 Yes 
No 
If yes, then please provide details (including links). 
Q93a 


Data protection impact assessments: Undertake a DPIA specifically to assess 
and mitigate risks to children who are likely to access your service, taking into 
account differing ages, capacities and development needs. Ensure that your 
DPIA builds in compliance with this code. 


Q94 I would like to respond to this standard 


© Skip 


Have we communicated our expectations for this standard clearly? 
Q95 Yes 
No 
If no, then please give reasons for your answer. 
Q95a 


Do you have any examples that you think could be used to illustrate the 
approach we are advocating to this standard? 


Q96 Yes 
No 
If yes, then please give reasons for your answer. 
Q96a 


Do you think this standard gives rise to any unwarranted or unintended 


consequences? 
Q97 (©) Yes 
No 
If yes, then please give reasons for your answer. 
Q97a 


Do you envisage any feasibility challenges to online services delivering this standard? 
Q98 Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Q98a 


Do you think this standard requires a transition period of any longer than 3 months 
after the code comes into force? 


Q99 Yes 


No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Q99a 


Do you know of any online resources that you think could be usefully linked to from 
this section of the code? 


Q100 Yes 


No 
Q100 If yes, then please provide details (including links). 
a 


Q101 


Q106 


Q106 
a 


Governance and accountability: Ensure you have policies and procedures in 
place which demonstrate how you comply with data protection obligations, 
including data protection training for all staff involved in the design and 
development of online services likely to be accessed by children. Ensure that 
your policies, procedures and terms of service demonstrate compliance with the 
provisions of this code 


I would like to respond to this standard 


Have we communicated our expectations for this standard clearly? 
Yes 


No 
If no, then please give reasons for your answer. 


Do you have any examples that you think could be used to illustrate the approach we 
are advocating to this standard? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you think this standard gives rise to any unwarranted or unintended 
consequences? 


Yes 


No 
If yes, then please give reasons for your answer. 


Do you envisage any feasibility challenges to online services delivering this standard? 
Yes 


No 


If yes, then please provide details of what you think the challenges are and how you 
think they could be overcome? 


Do you think this standard requires a transition period of any longer than 3 
months after the code comes into force? 

Yes 

No 


If yes, then please provide your reasons for this view, and give an indication of what 
you think a reasonable transition period would be and why. 


Do you know of any online resources that you think could be usefully linked to 
from this section of the code? 


Q107 ©) Yes 
O No 


Q107 If yes, then please provide details (including links). 
a 


Q108 If no, then please provide your reasons for this view. 
a 


Q109 @ Yes 
O No 


Q109 If no, then please provide your reasons for this view. 
a 


Q110 ©) Yes 
© No 


Q110 If yes, then please provide your reasons for this view. 
a 


Q111 @ Yes 
©) No 


Q111 If no, then please provide your reasons for this view. 
a 


Q112 @ Yes 
O No 


Q112 I am thrilled to see such a detailed child development section which successfully 
encompasses so much relevant research. My only suggestion is whether it would be 
feasible to provide a quick reference flow chart encompassing age, developmental 
abilities and factors to consider re: consent? 


Q113 ©) Yes 
© No 


Q113 If yes, then please provide details (including links). 
a 


Q114 @ Yes 
O No 


Q114 If no, then please provide your reasons for this view. 
a 


Q115 © Yes 
© No 


Q115 I think this template is excellent. My concern is that that the essential questions at 

a the top of each section may not all be considered in the writing of the DPIA, as 
readers will tend to read the first and last few questions and view the middle 
questions as more optional. To ensure that all questions are equally thought through, 
could you structure the questions so that they are listed separately with a tick box to 
complete once each question has been answered? In particular, this would be 
important for the section titled "Describe the context of the processing". In Step 5 I 
wonder if it would be worth adding in a separate row for each of the 5 age ranges so 
that those completing the DPIA would need to actively rule out an age group rather 
than rule in an age group (meaning that they will consider all ages as a matter of 
course, even if they then complete that row with a N/A). Finally, it may be worth 
considering ranking likelihood of harm, severity of harm and overall risk on a Likert 
scale of 1-5. Using numerical ratings rather than descriptive ranges can lead to more 
nuanced and meaningful responses. Then in Step 6 details could be given on how to 
address risks rated as 3 or above. 


Do you think any issues raised by the code would benefit from further (post 
publication) work, research or innovation? 

Q116 © Yes 
©) No 


Q116 This excellent code leads a significant shift in understanding and beliefs about 

a childhood in the digital world. There are three rich and crucial seams of post 
publication reserach. 1.It would be so interesting to investigate the short-term and 
the long-term impact this code has on the beliefs, culture and decisions of tech 
companies when designing ISS for children, or for adults with children in mind. 2. It 
would be essential to research the impact this code has on the way children think 
about and engage with the digital world, exploring not only their activity but also 
their sense of digital agency. 3. Parents continue to act as gatekeepers of children 
to the digital world. This code challenges perceived norms of parenting in the digital 
world, including common parenting practices such as location tracking and automatic 
beliefs that apps designed for children are, by definition, 'good' for children. Speaking 
so clearly for the rights of children, this code may well instigate significant change in 
how parents think about the digital world. It would be fascinating to track any 
changes in views as well as behaviours by parents following publication. 


Section 4: About you 


Are you answering as: 

Q117 ©) A body representing the views or interests of children 
Oa body representing the views or interests of parents 
© A child development expert 
©) An academic 
O An individual acting in another professional capacity 
O A provider of an ISS likely to be accessed by children 


O A trade association representing ISS providers 
O An individual acting in a private capacity (e.g. someone providing their views as a 
member of the public of the public or a parent)? 


©) An ICO employee 
O Other 


Q117 Please specify: 
a 


Q117 Please specify: 
b 


Q118 


Thank you for responding to this consultation 
We value your input. 


